News

=========================================================== Ubuntu Security Notice USN-153-1 July 26, 2005 fetchmail vulnerability CAN-2005-2335 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: fetchmail The problem can be corrected by upgrading the affected package to version 6.2.5-8ubuntu2.1 (for Ubuntu 4.10), or 6.2.5-12ubuntu1.1 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Ross Boylan discovered a remote buffer overflow in fetchmail. By sending invalid responses with very long UIDs, a faulty or malicious POP server could crash fetchmail or execute arbitrary code with the privileges of the user invoking fetchmail. fetchmail is commonly run as root to fetch mail for multiple user accounts; in this case, this vulnerability could be exploited to compromise the whole system.